CVE-2026-65008

Grav 2.0.4 fixed in 2.0.7 contains a remote code execution vulnerability in Blueprint::dynamicData system/src/Grav/Common/Data/Blueprint.php, which passes a Class::method callable string and its arguments directly to calluserfuncarray without any allowlist. Because the form plugin routes page...

CVE-2026-65008

Grav 2.0.4 contains a remote code execution vulnerability in Blueprint::dynamicData(), where a Class::method callable string and arguments are passed to call_user_func_array() without an allowlist. The form plugin routes page frontmatter through this path, allowing an authenticated user with admi...

CVE-2026-64064

A flaw was found in the Linux kernel's netfs component. When a streaming write operation is performed, a memory page folio can remain marked as 'dirty' even after the associated data is removed by a file truncation. If this dirty page is subsequently accessed through a memory-mapped file mmap, th...

CVE-2026-64151

A flaw was found in the Linux kernel's IOMMU Input/Output Memory Management Unit page table driver. This vulnerability involves a missing check for the system's fundamental memory page size PAGESIZE within the pgsizebitmap data structure. While an IOMMU configuration with this missing check would...

EUVD-2026-46126

Use after free in GPU in Google Chrome on Android prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...

EUVD-2026-46127

Use after free in Network in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Critical...

EUVD-2026-46128

Use after free in Cast in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

EUVD-2026-46125

Use after free in CameraCapture in Google Chrome on Mac prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...

PT-2026-61930

Name of the Vulnerable Software and Affected Versions Grav versions 2.0.4 through 2.0.6 Description Remote code execution is possible through the Blueprint::dynamicData function in the system/src/Grav/Common/Data/Blueprint.php file. The issue occurs because a Class::method callable string and its...

PT-2026-63252

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.182 Description A use-after-free issue exists in the UI component, where a remote attacker can exploit heap corruption—a condition where memory is corrupted in the heap area—by using a crafted HTML...

PT-2026-63244

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.182 Description Insufficient validation of untrusted input within the Extensions component allows a remote attacker to spoof the contents of the Omnibox the browser's URL bar by using a specially...

PT-2026-63250

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.182 Description An inappropriate implementation in the WebAudio component allows a remote attacker to execute arbitrary code within a sandbox by enticing a user to visit a specially crafted HTML page...

PT-2026-63249

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.182 Description A type confusion issue exists in the WebAudio component. This occurs when the system incorrectly identifies the data type of an object, which can be leveraged by a remote attacker to...

ROS-20260721-73-0008

The vulnerability of WebRTC technology in Google Chrome and Microsoft Edge relates to memory boundary violation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially created HTML page...

CVE-2026-15903

Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-15901

Use after free in Network in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-15904

Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.128 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2026-15904

Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.128 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2026-15903

Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-15903

Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...